How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?

Short answer

TR7 recognizes them with two separate data sources. The Network Type Category classification tells where the address belongs: Network Type Category = Datacenter (providers such as AWS, Azure, Hetzner and Generic Hosting) and Network Type Group = Tor Exit Node. IP reputation, on the other hand, tells the abuse history of the address: the VPN IP and Open Proxy categories. These values are used with the Network Type Group, Network Type Category and Blacklist IP Category conditions in Load Balancer actions, and with the Network Type Group Control and IP Reputation Protection rules in Bot/DDoS protection. A network type alone does not mean "bad"; instead of blocking, marking or redirecting to verification is also possible.

Comparison

Traffic	Data source	Value in the interface	Where it is used
Tor	Network type	Network Type Group Tor Exit Node · Network Type Category Anonymizer (VPN / Proxy / Tor)	LB condition, Network Type Group Control
Data center	Network type	Network Type Category Datacenter; as groups, Amazon AWS, Microsoft Azure, Google Cloud, Hetzner… Generic Hosting	LB condition, Network Type Group Control
VPN	IP reputation	Blacklist IP Category VPN IP	LB condition, IP Reputation Protection, WAF Blacklist IP Category
Open proxy	IP reputation	Blacklist IP Category Open Proxy (open proxy, open relay or Tor exit node)	LB condition, IP Reputation Protection, WAF Blacklist IP Category

• A network type does not mean "bad": data center addresses can also belong to legitimate services. Reputation, on the other hand, looks at the history of the address (Network Type Category).
• Each address falls into a single network type group; since search engine bots are in the Verified Bot group, they do not fall into Datacenter.
• The VPN IP category is not in the default rows of IP Reputation Protection; Open Proxy, on the other hand, is among the categories quarantined in the first row.

How Is It Recognized and Handled?

1. Examining a single address: The network type, the ASN and the reputation categories are seen in the IP Lookup result card on the Settings → General Settings → IP Intelligence & Reputation screen (result card).
2. Separate handling with a Load Balancer condition: With Load Balancer → Conditions → Add, a Network Type Group (e.g. Tor Exit Node), Network Type Category (e.g. Datacenter) or Blacklist IP Category (e.g. VPN IP) condition is created. The condition is bound to the Block, Show Content or Advanced CAPTCHA action on an HTTP vService and to the TCP Connection Management action on an L7 TCP vService (redirecting anonymous access to verification). Blocking steps: Can I block known malicious IPs (IP Reputation / blacklist category)?
3. Marking without blocking: The Network Type Group and Network Type Category Smart Variables are written as headers to the request going to the Backend Service with the Add HTTP Header action; the application makes the decision.
4. Bot/DDoS rule: In the Network Type Group Control block of L7 DDoS Protection, groups are selected and an unlimited (direct action) or limited rule row is defined; for the rules to be applied, L7 DDoS Protection must be Active. For VPN IP, a separate row is added to the IP Reputation Protection list.

Common Misconceptions

• "The Anonymizer category covers all VPNs." The only group of the Anonymizer (VPN / Proxy / Tor) category is Tor Exit Node; VPN addresses are caught with the VPN IP category in the reputation data.
• "Blocking data center traffic completely is safe." Monitoring services, API clients and corporate exit points can also come from data center networks; marking or verification is preferred first.
• "A strict IP rule can be applied to mobile operator addresses." Mobile / CGNAT addresses are shared by many users; flexible limits are preferred (Mobile / CGNAT scenario).
• "Every unclassified address is a user." On an address that does not fall into any group, the network type conditions do not match.

How it is done in the documentation

• Network Type Group · Network Type Group Name
• Network Type Category · Network Type Category Name
• Blacklist IP Category · Supported IP Intelligence Categories

Related questions

• Can I block known malicious IPs (IP Reputation / blacklist category)?
• Can I block by ASN?
• How do I detect bots; can I allow good bots (Googlebot etc.) and block bad ones?